forked from TrueCloudLab/lego
Base implementation with registration support
This commit is contained in:
xenolf
commit
ea47f1137a
10 changed files with 932 additions and 0 deletions
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
|
|
@ -0,0 +1 @@
|
|||
lego.exe
|
||||
96
account.go
Normal file
96
account.go
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"crypto/rsa"
|
||||
"encoding/json"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path"
|
||||
|
||||
"github.com/xenolf/lego/acme"
|
||||
)
|
||||
|
||||
// Account represents a users local saved credentials
|
||||
type Account struct {
|
||||
Email string `json:"email"`
|
||||
key *rsa.PrivateKey
|
||||
Registration *acme.RegistrationResource `json:"registration"`
|
||||
|
||||
conf *Configuration
|
||||
}
|
||||
|
||||
// NewAccount creates a new account for an email address
|
||||
func NewAccount(email string, conf *Configuration) *Account {
|
||||
accKeysPath := conf.AccountKeysPath(email)
|
||||
// TODO: move to function in configuration?
|
||||
accKeyPath := accKeysPath + string(os.PathSeparator) + email + ".key"
|
||||
if err := checkFolder(accKeysPath); err != nil {
|
||||
logger().Fatalf("Could not check/create directory for account %s: %v", email, err)
|
||||
}
|
||||
|
||||
var privKey *rsa.PrivateKey
|
||||
if _, err := os.Stat(accKeyPath); os.IsNotExist(err) {
|
||||
logger().Printf("No key found for account %s. Generating a %v bit key.", email, conf.RsaBits())
|
||||
privKey, err = generateRsaKey(conf.RsaBits(), accKeyPath)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not generate RSA private account key for account %s: %v", email, err)
|
||||
}
|
||||
logger().Printf("Saved key to %s", accKeyPath)
|
||||
} else {
|
||||
privKey, err = loadRsaKey(accKeyPath)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not load RSA private key from file %s: %v", accKeyPath, err)
|
||||
}
|
||||
}
|
||||
|
||||
accountFile := path.Join(conf.AccountPath(email), "account.json")
|
||||
if _, err := os.Stat(accountFile); os.IsNotExist(err) {
|
||||
return &Account{Email: email, key: privKey, conf: conf}
|
||||
}
|
||||
|
||||
fileBytes, err := ioutil.ReadFile(accountFile)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not load file for account %s -> %v", email, err)
|
||||
}
|
||||
|
||||
var acc Account
|
||||
err = json.Unmarshal(fileBytes, &acc)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not parse file for account %s -> %v", email, err)
|
||||
}
|
||||
|
||||
acc.key = privKey
|
||||
acc.conf = conf
|
||||
|
||||
return &acc
|
||||
}
|
||||
|
||||
/** Implementation of the acme.User interface **/
|
||||
|
||||
// GetEmail returns the email address for the account
|
||||
func (a *Account) GetEmail() string {
|
||||
return a.Email
|
||||
}
|
||||
|
||||
// GetPrivateKey returns the private RSA account key.
|
||||
func (a *Account) GetPrivateKey() *rsa.PrivateKey {
|
||||
return a.key
|
||||
}
|
||||
|
||||
// GetRegistration returns the server registration
|
||||
func (a *Account) GetRegistration() *acme.RegistrationResource {
|
||||
return a.Registration
|
||||
}
|
||||
|
||||
/** End **/
|
||||
|
||||
// Save the account to disk
|
||||
func (a *Account) Save() error {
|
||||
jsonBytes, err := json.Marshal(a)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return ioutil.WriteFile(path.Join(a.conf.AccountPath(a.Email), "account.json"), jsonBytes, 0700)
|
||||
|
||||
}
|
||||
144
acme/client.go
Normal file
144
acme/client.go
Normal file
|
|
@ -0,0 +1,144 @@
|
|||
package acme
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/rsa"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/square/go-jose"
|
||||
)
|
||||
|
||||
// Logger is used to log errors; if nil, the default log.Logger is used.
|
||||
var Logger *log.Logger
|
||||
|
||||
// logger is an helper function to retrieve the available logger
|
||||
func logger() *log.Logger {
|
||||
if Logger == nil {
|
||||
Logger = log.New(os.Stderr, "", log.LstdFlags)
|
||||
}
|
||||
return Logger
|
||||
}
|
||||
|
||||
// User interface is to be implemented by users of this library.
|
||||
// It is used by the client type to get user specific information.
|
||||
type User interface {
|
||||
GetEmail() string
|
||||
GetRegistration() *RegistrationResource
|
||||
GetPrivateKey() *rsa.PrivateKey
|
||||
}
|
||||
|
||||
// Client is the user-friendy way to ACME
|
||||
type Client struct {
|
||||
regURL string
|
||||
user User
|
||||
}
|
||||
|
||||
// NewClient creates a new client for the set user.
|
||||
func NewClient(caURL string, usr User) *Client {
|
||||
if err := usr.GetPrivateKey().Validate(); err != nil {
|
||||
logger().Fatalf("Could not validate the private account key of %s -> %v", usr.GetEmail(), err)
|
||||
}
|
||||
|
||||
return &Client{regURL: caURL, user: usr}
|
||||
}
|
||||
|
||||
// Posts a JWS signed message to the specified URL
|
||||
func (c *Client) jwsPost(url string, content []byte) (*http.Response, error) {
|
||||
signer, err := jose.NewSigner(jose.RS256, c.user.GetPrivateKey())
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
signed, err := signer.Sign(content)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
signedContent := signed.FullSerialize()
|
||||
|
||||
resp, err := http.Post(url, "application/json", bytes.NewBuffer([]byte(signedContent)))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return resp, err
|
||||
}
|
||||
|
||||
// Register the current account to the ACME server.
|
||||
func (c *Client) Register() (*RegistrationResource, error) {
|
||||
logger().Print("Registering account ... ")
|
||||
jsonBytes, err := json.Marshal(registrationMessage{Contact: []string{"mailto:" + c.user.GetEmail()}})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resp, err := c.jwsPost(c.regURL, jsonBytes)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if resp.StatusCode == http.StatusConflict {
|
||||
// REVIEW: should this return an error?
|
||||
return nil, errors.New("This account is already registered with this CA.")
|
||||
}
|
||||
|
||||
var serverReg Registration
|
||||
decoder := json.NewDecoder(resp.Body)
|
||||
err = decoder.Decode(&serverReg)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
reg := &RegistrationResource{Body: serverReg}
|
||||
|
||||
links := parseLinks(resp.Header["Link"])
|
||||
reg.URI = resp.Header.Get("Location")
|
||||
if links["terms-of-service"] != "" {
|
||||
reg.TosURL = links["terms-of-service"]
|
||||
}
|
||||
|
||||
if links["next"] != "" {
|
||||
reg.NewAuthzURL = links["next"]
|
||||
} else {
|
||||
return nil, errors.New("The server did not return enough information to proceed...")
|
||||
}
|
||||
|
||||
return reg, nil
|
||||
}
|
||||
|
||||
func logResponseHeaders(resp *http.Response) {
|
||||
logger().Println(resp.Status)
|
||||
for k, v := range resp.Header {
|
||||
logger().Printf("-- %s: %s", k, v)
|
||||
}
|
||||
}
|
||||
|
||||
func logResponseBody(resp *http.Response) {
|
||||
body, _ := ioutil.ReadAll(resp.Body)
|
||||
logger().Printf("Returned json data: \n%s", body)
|
||||
}
|
||||
|
||||
func parseLinks(links []string) map[string]string {
|
||||
aBrkt := regexp.MustCompile("[<>]")
|
||||
slver := regexp.MustCompile("(.+) *= *\"(.+)\"")
|
||||
linkMap := make(map[string]string)
|
||||
|
||||
for _, link := range links {
|
||||
|
||||
link = aBrkt.ReplaceAllString(link, "")
|
||||
parts := strings.Split(link, ";")
|
||||
|
||||
matches := slver.FindStringSubmatch(parts[1])
|
||||
if len(matches) > 0 {
|
||||
linkMap[matches[2]] = parts[0]
|
||||
}
|
||||
}
|
||||
|
||||
return linkMap
|
||||
}
|
||||
27
acme/messages.go
Normal file
27
acme/messages.go
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
package acme
|
||||
|
||||
type registrationMessage struct {
|
||||
Contact []string `json:"contact"`
|
||||
}
|
||||
|
||||
// Registration is returned by the ACME server after the registration
|
||||
// The client implementation should save this registration somewhere.
|
||||
type Registration struct {
|
||||
ID int `json:"id"`
|
||||
Key struct {
|
||||
Kty string `json:"kty"`
|
||||
N string `json:"n"`
|
||||
E string `json:"e"`
|
||||
} `json:"key"`
|
||||
Recoverytoken string `json:"recoveryToken"`
|
||||
Contact []string `json:"contact"`
|
||||
}
|
||||
|
||||
// RegistrationResource represents all important informations about a registration
|
||||
// of which the client needs to keep track itself.
|
||||
type RegistrationResource struct {
|
||||
Body Registration
|
||||
URI string
|
||||
NewAuthzURL string
|
||||
TosURL string
|
||||
}
|
||||
192
cli.go
Normal file
192
cli.go
Normal file
|
|
@ -0,0 +1,192 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"log"
|
||||
"os"
|
||||
|
||||
"github.com/codegangsta/cli"
|
||||
"github.com/xenolf/lego/acme"
|
||||
)
|
||||
|
||||
// Logger is used to log errors; if nil, the default log.Logger is used.
|
||||
var Logger *log.Logger
|
||||
|
||||
// logger is an helper function to retrieve the available logger
|
||||
func logger() *log.Logger {
|
||||
if Logger == nil {
|
||||
Logger = log.New(os.Stderr, "", log.LstdFlags)
|
||||
}
|
||||
return Logger
|
||||
}
|
||||
|
||||
func main() {
|
||||
|
||||
app := cli.NewApp()
|
||||
app.Name = "lego"
|
||||
app.Usage = "Let's encrypt client to go!"
|
||||
app.Version = "0.0.1"
|
||||
|
||||
app.Commands = []cli.Command{
|
||||
{
|
||||
Name: "run",
|
||||
Usage: "Create and install a certificate",
|
||||
Action: run,
|
||||
},
|
||||
{
|
||||
Name: "auth",
|
||||
Usage: "Create a certificate",
|
||||
Action: func(c *cli.Context) {
|
||||
logger().Fatal("Not implemented")
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "install",
|
||||
Usage: "Install a certificate",
|
||||
Action: func(c *cli.Context) {
|
||||
logger().Fatal("Not implemented")
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "revoke",
|
||||
Usage: "Revoke a certificate",
|
||||
Action: func(c *cli.Context) {
|
||||
logger().Fatal("Not implemented")
|
||||
},
|
||||
Flags: []cli.Flag{
|
||||
cli.StringFlag{
|
||||
Name: "certificate",
|
||||
Usage: "Revoke a specific certificate",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "key",
|
||||
Usage: "Revoke all certs generated by the provided authorized key.",
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
Name: "rollback",
|
||||
Usage: "Rollback a certificate",
|
||||
Action: func(c *cli.Context) {
|
||||
logger().Fatal("Not implemented")
|
||||
},
|
||||
Flags: []cli.Flag{
|
||||
cli.IntFlag{
|
||||
Name: "checkpoints",
|
||||
Usage: "Revert configuration N number of checkpoints",
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
app.Flags = []cli.Flag{
|
||||
cli.StringSliceFlag{
|
||||
Name: "domains, d",
|
||||
Usage: "Add domains to the process",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "server, s",
|
||||
Value: "https://www.letsencrypt-demo.org/acme/new-reg",
|
||||
Usage: "CA hostname (and optionally :port). The server certificate must be trusted in order to avoid further modifications to the client.",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "authkey, k",
|
||||
Usage: "Path to the authorized key file",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "email, m",
|
||||
Usage: "Email used for registration and recovery contact.",
|
||||
},
|
||||
cli.IntFlag{
|
||||
Name: "rsa-key-size, B",
|
||||
Value: 2048,
|
||||
Usage: "Size of the RSA key.",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "no-confirm",
|
||||
Usage: "Turn off confirmation screens.",
|
||||
},
|
||||
cli.BoolFlag{
|
||||
Name: "agree-tos, e",
|
||||
Usage: "Skip the end user license agreement screen.",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "config-dir",
|
||||
Value: configDir,
|
||||
Usage: "Configuration directory.",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "work-dir",
|
||||
Value: workDir,
|
||||
Usage: "Working directory.",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "backup-dir",
|
||||
Value: backupDir,
|
||||
Usage: "Configuration backups directory.",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "key-dir",
|
||||
Value: keyDir,
|
||||
Usage: "Keys storage.",
|
||||
},
|
||||
cli.StringFlag{
|
||||
Name: "cert-dir",
|
||||
Value: certDir,
|
||||
Usage: "Certificates storage.",
|
||||
},
|
||||
}
|
||||
|
||||
app.Run(os.Args)
|
||||
}
|
||||
|
||||
func checkFolder(path string) error {
|
||||
if _, err := os.Stat(path); os.IsNotExist(err) {
|
||||
return os.MkdirAll(path, 0700)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func run(c *cli.Context) {
|
||||
err := checkFolder(c.GlobalString("config-dir"))
|
||||
if err != nil {
|
||||
logger().Fatalf("Cound not check/create path: %v", err)
|
||||
}
|
||||
|
||||
conf := NewConfiguration(c)
|
||||
|
||||
//TODO: move to account struct? Currently MUST pass email.
|
||||
if !c.GlobalIsSet("email") {
|
||||
logger().Fatal("You have to pass an account (email address) to the program using --email or -m")
|
||||
}
|
||||
|
||||
acc := NewAccount(c.GlobalString("email"), conf)
|
||||
client := acme.NewClient(c.GlobalString("server"), acc)
|
||||
if acc.Registration == nil {
|
||||
reg, err := client.Register()
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not complete registration -> %v", err)
|
||||
}
|
||||
|
||||
acc.Registration = reg
|
||||
acc.Save()
|
||||
|
||||
logger().Print("!!!! HEADS UP !!!!")
|
||||
logger().Printf(`
|
||||
Your account credentials have been saved in your Let's Encrypt
|
||||
configuration directory at "%s".
|
||||
You should make a secure backup of this folder now. This
|
||||
configuration directory will also contain certificates and
|
||||
private keys obtained from Let's Encrypt so making regular
|
||||
backups of this folder is ideal.
|
||||
|
||||
If you lose your account credentials, you can recover
|
||||
them using the token
|
||||
"%s".
|
||||
You must write that down and put it in a safe place.`, c.GlobalString("config-dir"), reg.Body.Recoverytoken)
|
||||
}
|
||||
|
||||
if !c.GlobalIsSet("domains") {
|
||||
logger().Fatal("Please specify --domains")
|
||||
}
|
||||
|
||||
}
|
||||
361
cli/main_unix.go
Normal file
361
cli/main_unix.go
Normal file
|
|
@ -0,0 +1,361 @@
|
|||
package cli
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/ecdsa"
|
||||
"crypto/elliptic"
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"flag"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/square/go-jose"
|
||||
)
|
||||
|
||||
var (
|
||||
newReg = flag.String("new-reg", "http://192.168.10.22:4000/acme/new-reg", "New Registration URL")
|
||||
accountKeyFile = flag.String("certKey", "account.key", "Private key file. Created if it does not exist.")
|
||||
accountTmpCrtFile = flag.String("acc-crt-file", "account-tmp.pem", "Temporary self signed certificate for challenges.")
|
||||
|
||||
email = flag.String("email", "", "Email address used for certificate retrieval.")
|
||||
domain = flag.String("domain", "", "The domain to request a certificate for")
|
||||
|
||||
ecdsaCurve = flag.String("ecdsa-curve", "", "ECDSA curve to use to generate a key. Valid values are P224, P256, P384, P521")
|
||||
bits = flag.Int("bits", 2048, "The size of the RSA keys in bits. Default 4096")
|
||||
)
|
||||
|
||||
// Logger is used to log errors; if nil, the default log.Logger is used.
|
||||
var Logger *log.Logger
|
||||
|
||||
// logger is an helper function to retrieve the available logger
|
||||
func logger() *log.Logger {
|
||||
if Logger == nil {
|
||||
Logger = log.New(os.Stderr, "", log.LstdFlags)
|
||||
}
|
||||
return Logger
|
||||
}
|
||||
|
||||
type Registration struct {
|
||||
Contact []string `json:"contact"`
|
||||
}
|
||||
|
||||
type Tos struct {
|
||||
Agreement string `json:"agreement"`
|
||||
}
|
||||
|
||||
type GetChallenges struct {
|
||||
Identifier `json:"identifier"`
|
||||
}
|
||||
|
||||
type Identifier struct {
|
||||
Type string `json:"type"`
|
||||
Value string `json:"value"`
|
||||
}
|
||||
|
||||
type ChallengesResponse struct {
|
||||
Identifier `json:"identifier"`
|
||||
Status string `json:"status"`
|
||||
Expires time.Time `json:"expires"`
|
||||
Challenges []Challenge `json:"challenges"`
|
||||
Combinations [][]int `json:"combinations"`
|
||||
}
|
||||
|
||||
type Challenge struct {
|
||||
Type string `json:"type"`
|
||||
Status string `json:"status"`
|
||||
URI string `json:"uri"`
|
||||
Token string `json:"token"`
|
||||
}
|
||||
|
||||
type SimpleHttpsMessage struct {
|
||||
Path string `json:"path"`
|
||||
}
|
||||
|
||||
type CsrMessage struct {
|
||||
Csr string `json:"csr"`
|
||||
Authorizations []string `json:"authorizations"`
|
||||
}
|
||||
|
||||
func execute() {
|
||||
flag.Parse()
|
||||
accountKey := generateKeyPair(*accountKeyFile).(*rsa.PrivateKey)
|
||||
jsonBytes, _ := json.Marshal(Registration{Contact: []string{"mailto:" + *email}})
|
||||
logger().Printf("Posting registration to %s", *newReg)
|
||||
|
||||
resp, _ := jwsPost(*newReg, jsonBytes)
|
||||
|
||||
links := parseLinks(resp.Header["Link"])
|
||||
if links["next"] == "" {
|
||||
logger().Fatalln("The server did not provide enough information to proceed.")
|
||||
}
|
||||
|
||||
logger().Printf("Got agreement URL: %s", links["terms-of-service"])
|
||||
logger().Printf("Got new auth URL: %s", links["next"])
|
||||
|
||||
jsonBytes, _ = json.Marshal(Tos{Agreement: links["terms-of-service"]})
|
||||
logger().Printf("Posting agreement to %s", resp.Header.Get("Location"))
|
||||
|
||||
resp, _ = jwsPost(resp.Header.Get("Location"), jsonBytes)
|
||||
logResponse(resp)
|
||||
|
||||
jsonBytes, _ = json.Marshal(GetChallenges{Identifier{Type: "dns", Value: *domain}})
|
||||
logger().Printf("Getting challenges for type %s and domain %s", "dns", *domain)
|
||||
|
||||
resp, _ = jwsPost(links["next"], jsonBytes)
|
||||
logResponse(resp)
|
||||
|
||||
links = parseLinks(resp.Header["Link"])
|
||||
if links["next"] == "" {
|
||||
logger().Fatalln("The server did not provide enough information to proceed.")
|
||||
}
|
||||
|
||||
logger().Printf("Got new cert URL: %s", links["next"])
|
||||
logger().Printf("Got new authorization URL: %s", resp.Header.Get("Location"))
|
||||
newCertUrl := links["next"]
|
||||
authUrl := resp.Header.Get("Location")
|
||||
body, _ := ioutil.ReadAll(resp.Body)
|
||||
|
||||
var challenges ChallengesResponse
|
||||
_ = json.Unmarshal(body, &challenges)
|
||||
|
||||
for _, challenge := range challenges.Challenges {
|
||||
logger().Printf("Got challenge %s", challenge.Type)
|
||||
}
|
||||
logger().Printf("Challenge combinations are: %v", challenges.Combinations)
|
||||
logger().Printf("Choosing first challenge combination and starting with %s", challenges.Challenges[challenges.Combinations[0][0]].Type)
|
||||
|
||||
firstChallenge := challenges.Challenges[challenges.Combinations[0][0]]
|
||||
if firstChallenge.Type == "simpleHttps" {
|
||||
generateSelfSignedCert(accountKey)
|
||||
|
||||
path := getRandomString(8) + ".txt"
|
||||
challengePath := "/.well-known/acme-challenge/" + path
|
||||
startChallengeTlsServer(challengePath, firstChallenge.Token)
|
||||
|
||||
logger().Print("Waiting for domain validation...")
|
||||
|
||||
jsonBytes, _ = json.Marshal(SimpleHttpsMessage{Path: path})
|
||||
logger().Printf("Sending challenge response for path %s", path)
|
||||
|
||||
resp, _ = jwsPost(firstChallenge.URI, jsonBytes)
|
||||
logResponse(resp)
|
||||
|
||||
// Loop until status is verified or error.
|
||||
var challengeResponse Challenge
|
||||
loop:
|
||||
for {
|
||||
decoder := json.NewDecoder(resp.Body)
|
||||
decoder.Decode(&challengeResponse)
|
||||
|
||||
switch challengeResponse.Status {
|
||||
case "valid":
|
||||
logger().Print("The CA validated our credentials. Continue...")
|
||||
break loop
|
||||
case "pending":
|
||||
logger().Print("The data is still being validated. Please stand by...")
|
||||
case "invalid":
|
||||
logger().Fatalf("The CA could not validate the provided file. - %v", challengeResponse)
|
||||
default:
|
||||
logger().Fatalf("The CA returned an unexpected state. - %v", challengeResponse)
|
||||
}
|
||||
|
||||
time.Sleep(1000 * time.Millisecond)
|
||||
resp, _ = http.Get(authUrl)
|
||||
}
|
||||
}
|
||||
|
||||
logger().Print("Getting certificate...")
|
||||
privateSslKey := generateKeyPair("ssl-priv.key")
|
||||
csr := generateCsr(privateSslKey)
|
||||
csrString := base64.URLEncoding.EncodeToString(csr)
|
||||
jsonBytes, _ = json.Marshal(CsrMessage{Csr: csrString, Authorizations: []string{authUrl}})
|
||||
resp, _ = jwsPost(newCertUrl, jsonBytes)
|
||||
logResponse(resp)
|
||||
|
||||
body, _ = ioutil.ReadAll(resp.Body)
|
||||
ioutil.WriteFile("ssl-crt.crt", body, 0644)
|
||||
}
|
||||
|
||||
func startChallengeTlsServer(path string, token string) {
|
||||
|
||||
cert, err := tls.LoadX509KeyPair(*accountTmpCrtFile, *accountKeyFile)
|
||||
tlsConf := new(tls.Config)
|
||||
tlsConf.Certificates = []tls.Certificate{cert}
|
||||
|
||||
tlsListener, err := tls.Listen("tcp", ":443", tlsConf)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not start TLS listener on %s for challenge handling! - %v", ":443", err)
|
||||
}
|
||||
|
||||
http.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Host == *domain && r.Method == "GET" {
|
||||
w.Write([]byte(token))
|
||||
tlsListener.Close()
|
||||
}
|
||||
})
|
||||
|
||||
srv := http.Server{Addr: ":443", Handler: nil}
|
||||
go func() {
|
||||
srv.Serve(tlsListener)
|
||||
logger().Print("TLS Server exited.")
|
||||
}()
|
||||
}
|
||||
|
||||
func getRandomString(length int) string {
|
||||
const alphanum = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
|
||||
var bytes = make([]byte, length)
|
||||
rand.Read(bytes)
|
||||
for i, b := range bytes {
|
||||
bytes[i] = alphanum[b%byte(len(alphanum))]
|
||||
}
|
||||
return string(bytes)
|
||||
}
|
||||
|
||||
func logResponse(resp *http.Response) {
|
||||
logger().Println(resp.Status)
|
||||
for k, v := range resp.Header {
|
||||
logger().Printf("-- %s: %s", k, v)
|
||||
}
|
||||
}
|
||||
|
||||
func jwsPost(url string, content []byte) (*http.Response, error) {
|
||||
url = strings.Replace(url, "localhost", "192.168.10.22", -1)
|
||||
|
||||
privKeyBytes, err := ioutil.ReadFile(*accountKeyFile)
|
||||
key, err := jose.LoadPrivateKey(privKeyBytes)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
|
||||
signer, err := jose.NewSigner(jose.RS256, key)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
signed, err := signer.Sign(content)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
signedContent := signed.FullSerialize()
|
||||
|
||||
resp, err := http.Post(url, "application/json", bytes.NewBuffer([]byte(signedContent)))
|
||||
if err != nil {
|
||||
logger().Fatalf("Error posting content: %s", err)
|
||||
}
|
||||
|
||||
return resp, err
|
||||
}
|
||||
|
||||
func generateCsr(privateKey interface{}) []byte {
|
||||
template := x509.CertificateRequest{
|
||||
Subject: pkix.Name{
|
||||
CommonName: *domain,
|
||||
},
|
||||
EmailAddresses: []string{*email},
|
||||
}
|
||||
|
||||
csrBytes, err := x509.CreateCertificateRequest(rand.Reader, &template, privateKey)
|
||||
|
||||
csrOut, err := os.Create("csr.pem")
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not create certificate request file: %s", err)
|
||||
}
|
||||
|
||||
pem.Encode(csrOut, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrBytes})
|
||||
|
||||
return csrBytes
|
||||
}
|
||||
|
||||
func generateKeyPair(fileName string) interface{} {
|
||||
logger().Println("Generating key pair ...")
|
||||
|
||||
var privateKey interface{}
|
||||
var err error
|
||||
switch *ecdsaCurve {
|
||||
case "":
|
||||
privateKey, err = rsa.GenerateKey(rand.Reader, *bits)
|
||||
case "P224":
|
||||
privateKey, err = ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
|
||||
case "P256":
|
||||
privateKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
case "P384":
|
||||
privateKey, err = ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
|
||||
case "P521":
|
||||
privateKey, err = ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
|
||||
}
|
||||
|
||||
if err != nil {
|
||||
logger().Fatalf("Failed to generate private key: %s", err)
|
||||
}
|
||||
|
||||
var pemKey pem.Block
|
||||
switch key := privateKey.(type) {
|
||||
case *rsa.PrivateKey:
|
||||
pemKey = pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)}
|
||||
case *ecdsa.PrivateKey:
|
||||
privateBytes, err := x509.MarshalECPrivateKey(key)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not marshal ECDSA private key: %v", err)
|
||||
}
|
||||
|
||||
pemKey = pem.Block{Type: "EC PRIVATE KEY", Bytes: privateBytes}
|
||||
}
|
||||
|
||||
certOut, err := os.Create(fileName)
|
||||
if err != nil {
|
||||
logger().Fatalf("Could not create private key file: %s", err)
|
||||
}
|
||||
|
||||
pem.Encode(certOut, &pemKey)
|
||||
certOut.Close()
|
||||
|
||||
return privateKey
|
||||
}
|
||||
|
||||
func generateSelfSignedCert(privKey *rsa.PrivateKey) {
|
||||
|
||||
serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
|
||||
serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
|
||||
if err != nil {
|
||||
log.Fatalf("failed to generate serial number: %s", err)
|
||||
}
|
||||
|
||||
template := x509.Certificate{
|
||||
SerialNumber: serialNumber,
|
||||
Subject: pkix.Name{
|
||||
CommonName: *email,
|
||||
Organization: []string{*domain},
|
||||
},
|
||||
NotBefore: time.Now(),
|
||||
NotAfter: time.Now().Add(365),
|
||||
|
||||
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
|
||||
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||
BasicConstraintsValid: true,
|
||||
DNSNames: []string{*domain},
|
||||
IsCA: true,
|
||||
}
|
||||
|
||||
derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privKey.PublicKey, privKey)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to create certificate: %s", err)
|
||||
}
|
||||
|
||||
certOut, err := os.Create(*accountTmpCrtFile)
|
||||
if err != nil {
|
||||
log.Fatalf("failed to open cert.pem for writing: %s", err)
|
||||
}
|
||||
pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
|
||||
certOut.Close()
|
||||
}
|
||||
48
configuration.go
Normal file
48
configuration.go
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"net/url"
|
||||
"os"
|
||||
"path"
|
||||
"strings"
|
||||
|
||||
"github.com/codegangsta/cli"
|
||||
)
|
||||
|
||||
// Configuration type from CLI and config files.
|
||||
type Configuration struct {
|
||||
context *cli.Context
|
||||
}
|
||||
|
||||
// NewConfiguration creates a new configuration from CLI data.
|
||||
func NewConfiguration(c *cli.Context) *Configuration {
|
||||
return &Configuration{context: c}
|
||||
}
|
||||
|
||||
// RsaBits returns the current set RSA bit length for private keys
|
||||
func (c *Configuration) RsaBits() int {
|
||||
return c.context.GlobalInt("rsa-key-size")
|
||||
}
|
||||
|
||||
// ServerPath returns the OS dependent path to the data for a specific CA
|
||||
func (c *Configuration) ServerPath() string {
|
||||
srv, _ := url.Parse(c.context.GlobalString("server"))
|
||||
srvStr := strings.Replace(srv.Host, ":", "_", -1) + srv.Path
|
||||
return strings.Replace(srvStr, "/", string(os.PathSeparator), -1)
|
||||
}
|
||||
|
||||
// AccountsPath returns the OS dependent path to the
|
||||
// local accounts for a specific CA
|
||||
func (c *Configuration) AccountsPath() string {
|
||||
return path.Join(c.context.GlobalString("config-dir"), "accounts", c.ServerPath())
|
||||
}
|
||||
|
||||
// AccountPath returns the OS dependent path to a particular account
|
||||
func (c *Configuration) AccountPath(acc string) string {
|
||||
return path.Join(c.AccountsPath(), acc)
|
||||
}
|
||||
|
||||
// AccountPath returns the OS dependent path to the keys of a particular account
|
||||
func (c *Configuration) AccountKeysPath(acc string) string {
|
||||
return path.Join(c.AccountPath(acc), "keys")
|
||||
}
|
||||
39
crypto.go
Normal file
39
crypto.go
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
package main
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
)
|
||||
|
||||
func generateRsaKey(length int, file string) (*rsa.PrivateKey, error) {
|
||||
privateKey, err := rsa.GenerateKey(rand.Reader, length)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
pemKey := pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)}
|
||||
|
||||
certOut, err := os.Create(file)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
pem.Encode(certOut, &pemKey)
|
||||
certOut.Close()
|
||||
|
||||
return privateKey, nil
|
||||
}
|
||||
|
||||
func loadRsaKey(file string) (*rsa.PrivateKey, error) {
|
||||
keyBytes, err := ioutil.ReadFile(file)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
keyBlock, _ := pem.Decode(keyBytes)
|
||||
return x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
|
||||
}
|
||||
11
path_unix.go
Normal file
11
path_unix.go
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
// +build !windows
|
||||
|
||||
package main
|
||||
|
||||
var (
|
||||
configDir = "/etc/letsencrypt"
|
||||
workDir = "/var/lib/letsencrypt"
|
||||
backupDir = "/var/lib/letsencrypt/backups"
|
||||
keyDir = "/etc/letsencrypt/keys"
|
||||
certDir = "/etc/letsencrypt/certs"
|
||||
)
|
||||
13
path_windows.go
Normal file
13
path_windows.go
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
// +build !linux
|
||||
|
||||
package main
|
||||
|
||||
import "os"
|
||||
|
||||
var (
|
||||
configDir = os.ExpandEnv("${PROGRAMDATA}\\letsencrypt")
|
||||
workDir = os.ExpandEnv("${PROGRAMDATA}\\letsencrypt")
|
||||
backupDir = os.ExpandEnv("${PROGRAMDATA}\\letsencrypt\\backups")
|
||||
keyDir = os.ExpandEnv("${PROGRAMDATA}\\letsencrypt\\keys")
|
||||
certDir = os.ExpandEnv("${PROGRAMDATA}\\letsencrypt\\certs")
|
||||
)
|
||||
Loading…
Reference in a new issue